vsomeip 3.7.3 and earlier can exhaust memory over TCP (CVE-2026-91141)
Original title: VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
A remote peer can force allocation of up to about 4 GB per connection before any bytes are validated.
CERT/CC says COVESA vsomeip through 3.7.3 grows a reliable TCP receive buffer to an attacker-declared SOME/IP length before checking that those bytes arrived. In the default configuration there is no size limit, so an unauthenticated peer can trigger allocation of up to roughly 4 GB with one short message, including against a connecting client. A service limited to 1.5 GB was OOM-killed by a 16-byte message claiming a 3 GB payload. The flaw, tracked as CVE-2026-91141 and GitHub issue #1009, is fixed in release 3.7.4 from July 6, 2026, which defaults the maximum message size to 10 MiB.
Unconfirmed: The note does not say whether the flaw has been exploited in real vehicle deployments.
- Affected versions are 3.7.3 and below; deployments with an explicit reliable size limit are not affected.
- No service credentials or SOME/IP authentication are required on a new connection.
- The public issue was opened February 26, 2026, and the CERT note is dated October 26, 2026.
- Without upgrading, operators can set max-payload-size-reliable and keep endpoints off untrusted networks.
Impact: Unauthenticated remote memory exhaustion and denial of service
| Product | Affected | Fixed in |
|---|---|---|
| COVESA vsomeip | 3.7.3 and below | 3.7.4 |
- 1.Upgrade to vsomeip 3.7.4 or later.
- 2.Set max-payload-size-reliable, or the per-service limit, if an upgrade is not immediate.
- 3.Keep reliable SOME/IP endpoints on trusted networks and limit TCP access to authorized peers.
- CVEs
- CVE-2026-91141
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91141 | — | — | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 5c669a1cd7f073647cc3d588f760019a5bd3a3df | someip/issues/1009 https://github.com/COVESA/vsomeip/commit/5c669a1cd7f073647cc3d588f760019a5bd3a3df https://github.com/COVESA/vsomeip/releases/tag/3.7.4 Other |
From the original article
3 min read at kb.cert.orgOverview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3. 7. 3 and below.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.